linux-ext4 - Re: [PATCH] fs: i_version mntopt gets visible through /proc/mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200618034535.h5ho7pd4eilpbj3f@gabell>
Date:   Wed, 17 Jun 2020 23:45:35 -0400
From:   Masayoshi Mizuma <msys.mizuma@...il.com>
To:     Dave Chinner <david@...morbit.com>
Cc:     "J. Bruce Fields" <bfields@...ldses.org>,
        Eric Sandeen <sandeen@...deen.net>,
        "Darrick J. Wong" <darrick.wong@...cle.com>,
        Christoph Hellwig <hch@...radead.org>,
        Theodore Ts'o <tytso@....edu>,
        Andreas Dilger <adilger.kernel@...ger.ca>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Masayoshi Mizuma <m.mizuma@...fujitsu.com>,
        linux-ext4@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-xfs <linux-xfs@...r.kernel.org>
Subject: Re: [PATCH] fs: i_version mntopt gets visible through /proc/mounts

On Thu, Jun 18, 2020 at 01:05:39PM +1000, Dave Chinner wrote:
> On Wed, Jun 17, 2020 at 09:30:26PM -0400, Masayoshi Mizuma wrote:
> > On Wed, Jun 17, 2020 at 02:45:07PM -0400, J. Bruce Fields wrote:
> > > On Wed, Jun 17, 2020 at 01:28:11PM -0500, Eric Sandeen wrote:
> > > > but mount(8) has already exposed this interface:
> > > > 
> > > >        iversion
> > > >               Every time the inode is modified, the i_version field will be incremented.
> > > > 
> > > >        noiversion
> > > >               Do not increment the i_version inode field.
> > > > 
> > > > so now what?
> > > 
> > > It's not like anyone's actually depending on i_version *not* being
> > > incremented.  (Can you even observe it from userspace other than over
> > > NFS?)
> > > 
> > > So, just silently turn on the "iversion" behavior and ignore noiversion,
> > > and I doubt you're going to break any real application.
> > 
> > I suppose it's probably good to remain the options for user compatibility,
> > however, it seems that iversion and noiversiont are useful for
> > only ext4.
> > How about moving iversion and noiversion description on mount(8)
> > to ext4 specific option?
> > 
> > And fixing the remount issue for XFS (maybe btrfs has the same
> > issue as well)?
> > For XFS like as:
> > 
> > diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> > index 379cbff438bc..2ddd634cfb0b 100644
> > --- a/fs/xfs/xfs_super.c
> > +++ b/fs/xfs/xfs_super.c
> > @@ -1748,6 +1748,9 @@ xfs_fc_reconfigure(
> >                         return error;
> >         }
> > 
> > +       if (XFS_SB_VERSION_NUM(&mp->m_sb) == XFS_SB_VERSION_5)
> > +               mp->m_super->s_flags |= SB_I_VERSION;
> > +
> >         return 0;
> >  }
> 
> no this doesn't work, because the sueprblock flags are modified
> after ->reconfigure is called.
> 
> i.e. reconfigure_super() does this:
> 
> 	if (fc->ops->reconfigure) {
> 		retval = fc->ops->reconfigure(fc);
> 		if (retval) {
> 			if (!force)
> 				goto cancel_readonly;
> 			/* If forced remount, go ahead despite any errors */
> 			WARN(1, "forced remount of a %s fs returned %i\n",
> 			     sb->s_type->name, retval);
> 		}
> 	}
> 
> 	WRITE_ONCE(sb->s_flags, ((sb->s_flags & ~fc->sb_flags_mask) |
> 				 (fc->sb_flags & fc->sb_flags_mask)));
> 
> And it's the WRITE_ONCE() line that clears SB_I_VERSION out of
> sb->s_flags. Hence adding it in ->reconfigure doesn't help.
> 
> What we actually want to do here in xfs_fc_reconfigure() is this:
> 
> 	if (XFS_SB_VERSION_NUM(&mp->m_sb) == XFS_SB_VERSION_5)
> 		fc->sb_flags_mask |= SB_I_VERSION;
> 
> So that the SB_I_VERSION is not cleared from sb->s_flags.
> 
> I'll also note that btrfs will need the same fix, because it also
> sets SB_I_VERSION unconditionally, as will any other filesystem that
> does this, too.

Thank you for pointed it out.
How about following change? I believe it works both xfs and btrfs...

diff --git a/fs/super.c b/fs/super.c
index b0a511bef4a0..42fc6334d384 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -973,6 +973,9 @@ int reconfigure_super(struct fs_context *fc)
                }
        }

+       if (sb->s_flags & SB_I_VERSION)
+               fc->sb_flags |= MS_I_VERSION;
+
        WRITE_ONCE(sb->s_flags, ((sb->s_flags & ~fc->sb_flags_mask) |
                                 (fc->sb_flags & fc->sb_flags_mask)));
        /* Needs to be ordered wrt mnt_is_readonly() */


- Masa

> 
> Really, this is just indicative of the mess that the mount
> flags vs superblock feature flags are. Filesystems can choose to
> unconditionally support various superblock features, and no mount
> option futzing from userspace should -ever- be able to change that
> feature. Filesystems really do need to be able to override mount
> options that were parsed in userspace and turned into a binary
> flag...
> 
> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@...morbit.com